General
-
Target
PO9683.xlsx
-
Size
369KB
-
Sample
211021-gsmfwshhb4
-
MD5
4dc7f582251c5b4e39c264de6762da49
-
SHA1
e1d9d7b3b07459deae3cdd4e069c017c90a43e5b
-
SHA256
6a93492f04506bcc6d5f0ab1199766a03e39cc4a4b3e668c3de238b8ce86ce5e
-
SHA512
ef8fd4e395b5d70dcc3d910c624e1e2c15a0a4912c830ac1dbf8f92c9531efd16d51c8aad9c3358063c2116ccc2660b2a152f133151c033e686e1c18a58f8cf9
Static task
static1
Behavioral task
behavioral1
Sample
PO9683.xlsx
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
PO9683.xlsx
Resource
win10-en-20211014
Malware Config
Extracted
xloader
2.5
kqna
http://www.surfsolutions.info/kqna/
achyutlifesciences.com
anthemmg.com
netkopat.com
generationgirlnaturals.com
novatel-network.com
craftstockco.com
thevishantiverse.art
elkerfly.com
haerotechs.com
candypalette.com
gregdokes.com
e-commerce.company
gratitudeland.com
companyintelcloud.com
publicyazilim.com
xc6811.com
aracsozluk.com
janesgalant.quest
fraserstephendop.com
ryan.rentals
wyse-solutions.com
reddishslouqb.xyz
rukygua.xyz
unlimitedrehab.com
fundafes.com
goodoffice.online
guserq.com
tigerstarmatka.com
ganleychevybuyscars.com
murrayforcongress.com
artistandfund.com
integritynotarial.com
cantomarbait.com
alifdanismanlik.com
meggisiegert.com
high-clicks3.com
xn--schwche-8wa.com
caffeiny.com
landsoftexasranchland.com
armmapp.com
cursosminharendaextra.com
globalmarineserv.com
lowestfars.com
finlayo.com
hautlescoeurscollection.com
cyclesforyou.com
bagwashs.com
medicaltrust-sd.com
passivemen.com
midatlanticbath.com
mchaskellproperties.com
facetofacewith.com
worldwidecorumuk.com
g632b.online
atozshoppingllc.com
jcswkj.net
czemi.com
minutemannetwork.net
hjku.xyz
uko7wuyj.xyz
amigasconesencia.com
hodgeandpartners.com
edfnu.com
corncobmeal.com
Targets
-
-
Target
PO9683.xlsx
-
Size
369KB
-
MD5
4dc7f582251c5b4e39c264de6762da49
-
SHA1
e1d9d7b3b07459deae3cdd4e069c017c90a43e5b
-
SHA256
6a93492f04506bcc6d5f0ab1199766a03e39cc4a4b3e668c3de238b8ce86ce5e
-
SHA512
ef8fd4e395b5d70dcc3d910c624e1e2c15a0a4912c830ac1dbf8f92c9531efd16d51c8aad9c3358063c2116ccc2660b2a152f133151c033e686e1c18a58f8cf9
-
Xloader Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-